Bug 41751 - Cash register transaction history returns 403 for users with only anonymous_refund permission
Summary: Cash register transaction history returns 403 for users with only anonymous_r...
Status: Needs Signoff
Alias: None
Product: Koha
Classification: Unclassified
Component: Point of Sale (show other bugs)
Version: unspecified
Hardware: All All
: P5 - low enhancement
Assignee: Martin Renvoize (ashimema)
QA Contact: Testopia
URL:
Keywords:
Depends on: 24082
Blocks:
  Show dependency treegraph
 
Reported: 2026-02-02 13:51 UTC by Martin Renvoize (ashimema)
Modified: 2026-02-02 17:41 UTC (History)
4 users (show)

See Also:
GIT URL:
Initiative type: ---
Sponsorship status: Sponsored
Comma delimited list of Sponsors: OpenFifth <https://openfifth.co.uk/>
Crowdfunding goal: 0
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:


Attachments
Bug 41751: Allow anonymous_refund permission to access cashups API (6.58 KB, patch)
2026-02-02 14:01 UTC, Martin Renvoize (ashimema)
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Martin Renvoize (ashimema) 2026-02-02 13:51:13 UTC
When a user has the cash_management > anonymous_refund permission but NOT the cashup permission, they can access the cash register transaction history page (/cgi-bin/koha/pos/register.pl), but the cashups table fails to load with a 403 error.

Steps to Reproduce:
1. Create a staff user with only cash_management > anonymous_refund permission (not cashup)
2. Navigate to Point of Sale > Transaction history for any cash register
3. Observe that the page loads but the cashups table shows a 403 error

Expected Behavior:
The cashups table should load successfully since the user has permission to view the page.

Actual Behavior:
The API endpoint /api/v1/cash_registers/{id}/cashups returns 403 Forbidden because it only checks for cashup permission.
Comment 1 Martin Renvoize (ashimema) 2026-02-02 14:01:54 UTC
Created attachment 192320 [details] [review]
Bug 41751: Allow anonymous_refund permission to access cashups API

The cash register transaction history page (pos/register.pl) allows
access with either cashup OR anonymous_refund permission, but the
API endpoints for fetching cashups only checked for cashup permission.

This caused a 403 error when users with only anonymous_refund permission
tried to view the transaction history page, as the cashups table failed
to load.

This patch updates the API permissions for:
- GET /cash_registers/{id}/cashups
- GET /cashups/{id}

to accept either cashup or anonymous_refund permission, matching the
page access logic.

Test plan:
1. Create a staff user with only cash_management > anonymous_refund
   permission (not cashup)
2. Navigate to Point of Sale > Transaction history for any cash register
3. Verify the cashups table loads successfully (previously returned 403)
4. Run: prove t/db_dependent/api/v1/cashups.t